{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/whisper-node--1.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:whisper-node_project:whisper-node:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110640"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["whisper-node (\u003c= 1.1.1)"],"_cs_severities":["critical"],"_cs_tags":["command-injection","rce","nodejs","software-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Whisper-node"],"content_html":"\u003cp\u003eWhisper-node versions through 1.1.1 are susceptible to an OS command injection vulnerability triggered by improper input validation within the whisper() function. The library uses the createCppCommand() utility to build command strings, which are subsequently passed to shelljs.exec() for execution. By supplying malicious shell metacharacters or command substitution sequences (such as $()) within the 'filePath' or 'whisperOptions.language' parameters, an attacker can manipulate the constructed command string. This vulnerability enables the execution of arbitrary commands with the same privileges as the underlying Node.js process, posing a critical risk to environments utilizing this library for server-side audio processing.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an application utilizing the vulnerable whisper-node library (\u0026lt;= 1.1.1) to process user-supplied file paths or language options.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious input string containing shell metacharacters (e.g., ;, \u0026amp;\u0026amp;, |) or command substitution syntax ($()).\u003c/li\u003e\n\u003cli\u003eThe attacker submits the crafted input via an API endpoint or user interface that interfaces with the whisper() function.\u003c/li\u003e\n\u003cli\u003eThe whisper() function passes the malicious input to the createCppCommand() internal helper.\u003c/li\u003e\n\u003cli\u003eThe helper fails to sanitize the input and concatenates it into a shell command string.\u003c/li\u003e\n\u003cli\u003eThe application invokes shelljs.exec() with the concatenated, malicious string.\u003c/li\u003e\n\u003cli\u003eThe Node.js process executes the injected commands, resulting in unauthorized command execution.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their objective, such as initial access, data exfiltration, or lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows for remote code execution on the server hosting the Node.js application. Depending on the environment and the privileges of the Node.js process, an attacker could compromise sensitive data, gain persistence, or leverage the host machine to pivot into internal networks. The vulnerability is highly critical due to the ease of injection and the widespread use of such libraries in media-processing services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the whisper-node dependency to a patched version (if available) or implement strict input validation for all values passed to the whisper() function. Ensure that no user-supplied data is passed directly into shell-executing functions.\u003c/p\u003e\n","date_modified":"2026-10-14T16:33:38Z","date_published":"2026-10-14T16:33:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-whisper-node-command-injection/","summary":"The whisper-node library through version 1.1.1 is vulnerable to OS command injection via unsanitized input in the whisper() function, allowing attackers to execute arbitrary shell commands.","title":"OS Command Injection in Whisper-node","url":"https://feed.craftedsignal.io/briefs/2026-10-whisper-node-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Whisper-Node (\u003c= 1.1.1)","version":"https://jsonfeed.org/version/1.1"}